一种基于明可夫斯基距离的加壳PE文件识别方法  

Minkowski distance based method to identify packed PE files

作　　者：吴丽娟[1] 李阳[2] 梁京章[1] 

机构地区：[1]广西大学信息网络中心,广西南宁530004 [2]广西大学计算机与电子信息学院,广西南宁530004

出　　处：《现代电子技术》2016年第19期80-81,88,共3页Modern Electronics Technique

基　　金：广西教育科学"十二五"规划2015年度教育信息化工作专项课题(2015ZKY9)

摘　　要：针对绝大多数的木马都经过了PE文件加壳处理的情况,对PE文件的加壳检测进行了研究。对基于欧几里得距离的加壳PE文件识别方法进行改进,在此基础上提出了基于明可夫斯基距离对PE文件进行分类,检测PE文件是否加壳。实验表明,相对于流行的PEid工具,该法具有较高的检测率、误报率和漏报率也在可接受的范围内。Since the vast majority of Trojan Houses have been disposed by means of packed PE files, detection for the packed PE files is studied. The Euclidean distance based method to identify packed PE files was improved. And on this basis, the method based on Minkowski distance is put forward to the classify PE files, and detect whether PE files are packed. The ex- perimental results show that, in comparison with the popular PEid tool, the method has higher detection rate, and its false alarm rate and false negative rate are also within the acceptable range.

关 键 词：木马识别 PE文件 加壳检测 PEid 

分 类 号：TN911.73[电子电信—通信与信息系统]